Patch "udf: Prevent buffer overrun with multi-byte characters" has been added to the 3.14-stable tree

This is a note to let you know that I've just added the patch titled

udf: Prevent buffer overrun with multi-byte characters

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
udf-prevent-buffer-overrun-with-multi-byte-characters.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Andrew Gabbasov <[email protected]>
Date: Thu, 24 Dec 2015 10:25:32 -0600
Subject: udf: Prevent buffer overrun with multi-byte characters

From: Andrew Gabbasov <[email protected]>

commit ad402b265ecf6fa22d04043b41444cdfcdf4f52d upstream.

udf_CS0toUTF8 function stops the conversion when the output buffer length reaches UDF_NAME_LEN-2, which is correct maximum name length, but, when checking, it leaves the space for a single byte only, while multi-bytes output characters can take more space, causing buffer overflow.

Similar error exists in udf_CS0toNLS function, that restricts the output length to UDF_NAME_LEN, while actual maximum allowed length is UDF_NAME_LEN-2.

In these cases the output can override not only the current buffer length field, causing corruption of the name buffer itself, but also following allocation structures, causing kernel crash.

Adjust the output length checks in both functions to prevent buffer overruns in case of multi-bytes UTF8 or NLS characters.

---
 fs/udf/unicode.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

@@ -132,11 +132,15 @@ int udf_CS0toUTF8(struct ustr *utf_o, co
 		if (c < 0x80U)
 			utf_o->u_name[utf_o->u_len++] = (uint8_t)c;
 		else if (c < 0x800U) {
+			if (utf_o->u_len > (UDF_NAME_LEN - 4))
+				break;
 			utf_o->u_name[utf_o->u_len++] =
 						(uint8_t)(0xc0 | (c >> 6));
 			utf_o->u_name[utf_o->u_len++] =
 						(uint8_t)(0x80 | (c & 0x3f));
 		} else {
+			if (utf_o->u_len > (UDF_NAME_LEN - 5))
+				break;
 			utf_o->u_name[utf_o->u_len++] =
 						(uint8_t)(0xe0 | (c >> 12));
 			utf_o->u_name[utf_o->u_len++] =

@@ -281,7 +285,7 @@ static int udf_CS0toNLS(struct nls_table
 			c = (c << 8) | ocu[i++];
 
 		len = nls->uni2char(c, &utf_o->u_name[utf_o->u_len],
-				    UDF_NAME_LEN - utf_o->u_len);
+				    UDF_NAME_LEN - 2 - utf_o->u_len);
 		/* Valid character? */
 		if (len >= 0)
 			utf_o->u_len += len;

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/udf-check-output-buffer-length-when-converting-name-to-cs0.patch queue-3.14/udf-prevent-buffer-overrun-with-multi-byte-characters.patch